<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook V4.1//EN"
[
  <!ENTITY intro SYSTEM "intro.sgml">
  <!ENTITY before_we_start SYSTEM "before_we_start.sgml">
  <!ENTITY magic_of_elf SYSTEM "magic_of_elf.sgml">
  <!ENTITY readelf SYSTEM "readelf.sgml">
  <!ENTITY one_step_closer SYSTEM "one_step_closer.sgml">
  <!ENTITY entry_point SYSTEM "entry_point.sgml">
  <!ENTITY rst SYSTEM "rst.sgml">
  <!ENTITY additional_cs SYSTEM "additional_cs.sgml">

  <!ENTITY % calc SYSTEM "out/calc.sgml">
  %calc;

  <!ENTITY jargon "http://www.tuxedo.org/~esr/jargon/html/entry/">
  <!ENTITY jargon_backdoor "&jargon;back-door.html">
  <!ENTITY jargon_buffer_overflow "&jargon;buffer-overflow.html">
  <!ENTITY jargon_exploit "&jargon;exploit.html">
  <!ENTITY jargon_FUD "&jargon;FUD.html">
  <!ENTITY jargon_RTFM "&jargon;RTFM.html">
  <!ENTITY jargon_trojan "&jargon;Trojan-horse.html">
  <!ENTITY jargon_virus "&jargon;virus.html">
  <!ENTITY jargon_worm "&jargon;worm.html">

  <!ENTITY list_linuxdoc
    "http://list.linuxdoc.org/archive/index.htm?1">
  <!ENTITY silvio_cesare "http://www.big.net.au/~silvio">
  <!ENTITY nasm_site "http://nasm.2y.net">
  <!ENTITY elf_spec_canonical
    "ftp://tsx.mit.edu/pub/linux/packages/GCC/ELF.doc.tar.gz">
  <!ENTITY elf_spec_flat_text
    "http://www.muppetlabs.com/~breadbox/software/ELF.txt">
  <!ENTITY teensy_executables
    "http://www.muppetlabs.com/~breadbox/software/tiny/teensy.html">
  <!ENTITY linuxassembly_startup
    "http://linuxassembly.org/startup.html">

  <!ENTITY securiteam
    "http://www.securiteam.com">
  <!ENTITY securiteam_5MP022K5GE "&securiteam;/unixfocus/5MP022K5GE.html">

  <!ENTITY vmyths "http://vmyths.com">
  <!ENTITY vmyths_osama "&vmyths;/rant.cfm?id=410&amp;page=4">

  <!ENTITY newsbytes "http://www.newsbytes.com">
  <!ENTITY newsbytes_02_173408 "&newsbytes;/news/02/173408.html">

]>
<article id="index">

<articleinfo>
  <title>The Linux Virus Writing And Detection HOWTO</title>
  <subtitle>
    post link-time code modification of ELF executables under Linux/i386
  </subtitle>
  <author>
    <firstname>Alexander</firstname>
    <surname>Bartolich</surname>
    <affiliation>
      <address>
	<email>alexander.bartolich@gmx.at</email>
      </address>
    </affiliation>
  </author>

  <abstract>
    <para>
      Measurement is the foundation of science. This document describes
      how to write parasitic file viruses infecting ELF executables on
      Linux/i386. Though it contains a lot of source code, no actual
      virus is included.
    </para>
    <para>
      <emphasis>
	Unfinished snapshot taken on 2002-03-19.
	The mosquito exists to keep the mighty humble.
      </emphasis>
    </para>
  </abstract>

</articleinfo>

<sect1 id="intro">
  <title>Introduction</title>
  &intro;
</sect1>
<sect1 id="before_we_start" xreflabel="Before we start">
  <title>Before we start</title>
  &before_we_start;
</sect1>
<sect1 id="magic_of_elf" xreflabel="The magic of the Elf">
  <title>The magic of the Elf</title>
  &magic_of_elf;
</sect1>
<sect1 id="readelf" xreflabel="readelf">
  <title>readelf</title>
  &readelf;
</sect1>
<sect1 id="one_step_closer" xreflabel="One step closer to the edge">
  <title>One step closer to the edge</title>
  &one_step_closer;
</sect1>
<sect1 id="entry_point" xreflabel="The entry point">
  <title>The entry point</title>
  &entry_point;
</sect1>
<sect1 id="rst" xreflabel="Remote shell trojan (RST)">
  <title>Remote shell trojan (RST)</title>
  &rst;
</sect1>
<sect1 id="additional_cs" xreflabel="Additional code segments">
  <title>Additional code segments</title>
  &additional_cs;
</sect1>

</article>
